Privacy Policy

1. Who we are

Inlay (“we”, “us”, “our”) operates the Inlay platform, accessible at useinlay.com. We provide native ad monetisation services to website publishers. This policy explains what personal data we collect, why, and how you can control it.

2. Data we collect

Account data. When you create an account we collect your name, email address, and (for password accounts) a bcrypt-hashed password. OAuth sign-ins (Google, GitHub) provide your name, email, and profile picture via the provider.

Billing data. Subscription and payment details are handled entirely by Stripe. We store your Stripe customer ID and subscription status but never see full card numbers.

Publisher payout data. For Stripe Connect payouts we store your connected account ID and payout history. Bank account details are held exclusively by Stripe.

Analytics data.We collect aggregated impression and click counts per ad placement. We also record an individual event (page URL, timestamp, event type) each time an ad is shown or clicked on a publisher's site; these per-event records are retained for up to 30 days and then deleted (see Section 5).

End-visitor page data.The Inlay embed script analyses the structure of a publisher's page to generate a matching ad template. Before anything leaves the visitor's browser, all visible text, links, image URLs, and background images are stripped and replaced with placeholders — what's sent describes the page's HTML structure only, never its actual content. This redacted structure may be processed by Anthropic's Claude API (see Section 4) to help choose an ad format; it is not linked to a visitor identity, and no cookie or persistent identifier is created for end visitors.

Technical data.Standard server logs (IP address, user agent, request path, timestamp) retained for up to 30 days for security and debugging. This applies to requests from publishers' end visitors as well as to Inlay account holders — for example, an end visitor's IP address is used briefly to rate-limit ad requests.

3. How we use your data

• To provide, maintain and improve the Inlay platform
• To process subscription billing and publisher payouts
• To send transactional emails (account events, payout notifications, payment alerts)
• To enforce plan limits and prevent abuse
• To comply with legal obligations

We do not sell your account data (Section 2) to third parties, and we do not use it for behavioural advertising. Separately: running the real-time SSP auction necessarily discloses limited end-visitor data (page URL, contextual signals, consent string — Section 2, “End-visitor page data”) to demand partners in exchange for the resulting bid. Under California's CCPA/CPRA, that exchange may meet the statutory definition of a “sale” or “share” even though no data broker transaction or persistent profiling is involved — see Section 7 for how we handle opt-outs of that specific activity.

4. Third-party services

For end-visitor data processed via the ad-serving Service, Inlay acts as your publisher account's processor, not controller — see the Data Processing Addendum for the full breakdown of roles and which of the sub-processors below (if any) are engaged in that role. For the account, billing, and payout data described in Section 2, Inlay is the controller, and the sub-processors below act on Inlay's own instructions.

We use the following sub-processors:

• Stripe — payment processing and publisher payouts (USA)
• Vercel — hosting and serverless compute (USA/EU)
• Anthropic — processes a redacted page-structure snapshot (no visible text, links, or images) via the Claude API to generate ad templates (USA)
• Resend — transactional email delivery (USA)
• Sentry— error monitoring (USA/EU). Error events may include technical data described in Section 2 and are retained under Sentry's own subprocessor retention policy, which is independent of, and may exceed, the 30-day window described in Section 5 for our own server logs. We scrub visitor page content, consent strings, and IP addresses from error events before they reach Sentry wherever technically feasible.
• Upstash — distributed rate limiting (USA/EU, if configured)

Where any of the above transfers personal data from the EEA, UK, or Switzerland to the United States, that transfer relies on Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum) incorporated into Inlay's or that sub-processor's own data processing terms, as the applicable transfer mechanism under GDPR, UK GDPR, and Swiss FADP.

5. Data retention

Account data is retained for the lifetime of your account and deleted within 30 days of account deletion. Aggregated analytics (impression and revenue totals) may be retained for up to 7 years for financial record-keeping. Server logs generated and stored by Inlay itself are deleted after 30 days. Individual ad-event records that include an end visitor's page URL (Section 2, “Analytics data”) are deleted after 30 days by an automated daily process — only the aggregated totals persist beyond that window. This 30-day window applies to logs and analytics records we store directly; it does not apply to Sentry, whose own retention policy is described in Section 4.

6. Your rights

Under GDPR and equivalent laws you have the right to access, correct, export, or delete the personal data we hold about you. You can self-serve access and deletion from Settings (below); for anything else, email privacy@useinlay.com. We will respond within 30 days.

You may download a copy of your account, sites, and payout data at any time from Settings → Your data.

You may delete your account at any time from Settings → Delete account. This removes your account, sites, placements, and campaigns, and requests closure of your Stripe Connect account (Stripe may retain some KYC data per its own regulatory obligations, independent of Inlay). Payout records are not deleted outright: they're our financial ledger, so deletion strips the identifying link to your account but retains the payout amounts and dates for the 7-year window described in Section 5.

7. US privacy rights (CCPA/CPRA)

This section applies to California residents and, where their state law provides equivalent rights, residents of other US states. It supplements Section 6 rather than replacing it, and covers end visitors of publisher sites running the Inlay embed as well as Inlay account holders.

Sale/sharing determination.As described in Section 3, disclosing limited end-visitor data to SSPs during the real-time auction — in exchange for the resulting bid — may constitute a “sale” and/or “share” of personal information under CCPA/CPRA's broad statutory definitions, even though we don't sell data to data brokers or build persistent visitor profiles from it.

Opt-out.We automatically and frictionlessly honor Global Privacy Control (GPC) and GPP-encoded state opt-out signals on every ad request, from every visitor, on every publisher's site: no ad is served and no data is disclosed to SSPs, with no fee, no degraded non-ad experience, and no pop-up or interstitial asking a visitor to reconsider (11 CCR §7025(f)). Because this is frictionless processing of an opt-out preference signal, we rely on it as our opt-out mechanism rather than posting a separate “Do Not Sell or Share My Personal Information” link (11 CCR §7025(g)). If your browser doesn't send a GPC signal, you can enable one (see globalprivacycontrol.org) or email privacy@useinlay.com to opt out directly.

Other rights.You have the right to know what personal information we've collected about you, request its deletion or correction, opt out of sale/sharing (above), and not be discriminated against for exercising these rights. Email privacy@useinlay.com to exercise any of these — we will respond within 45 days, extendable once by a further 45 days for complex requests (with notice to you within the initial 45-day period).

8. Cookies

We use a single session cookie to keep you logged in. We do not use tracking or advertising cookies. See our Cookie Policy for details.

9. Changes to this policy

We may update this policy from time to time. Material changes will be emailed to registered users at least 14 days in advance. Continued use of the platform after the effective date constitutes acceptance.

10. Contact

For privacy questions or data requests, contact us at privacy@useinlay.com.